SourceCodester Online Voting System SQL Injection

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.

SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.

Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.